Privacy Policy

Last updated: February 2026

Who I am

This website is run by Tomas Leach, a documentary and commercial filmmaker based in Madrid, Spain. If you have any questions about how your data is used, you can reach me at tomas@tomasleach.com.

What data I collect and why

Newsletter sign-up When you subscribe to my newsletter (Little Scraps of Filmmaking), I collect your email address. I use this solely to send you the newsletter. Your email is stored by Substack, which handles the mailing list. You can unsubscribe at any time using the link at the bottom of every email.

Shop purchases If you buy something from the shop, I collect the information needed to process your order: your name, email address, delivery address (for physical products), and payment details. Payments are processed securely by Stripe — I do not see or store your full card details. Order information is stored by Squarespace Commerce.

Film rentals and purchases If you rent or buy a film, the transaction is handled by Vimeo OTT. Your payment and account information is managed by Vimeo under their own privacy policy.

Booking a session If you book a consultancy session or talk, the booking is handled by Acuity Scheduling (or Calendly). They collect your name, email, and any details you provide when booking. This information is used only to arrange and deliver the session.

Contact If you email me directly, I keep our correspondence to respond to you. I don't add you to any mailing list without your permission.

Cookies

This site uses cookies — small files stored on your device — for essential site functionality and analytics.

Essential cookies are set by Squarespace to make the site work (e.g. remembering your cart, keeping you logged in if you have an account). These are necessary and cannot be turned off.

Analytics cookies help me understand how visitors use the site — which pages are visited, how long people stay, where visitors come from. This data is anonymous and aggregated. I use this to improve the site, not to identify individuals.

You can manage your cookie preferences using the banner that appears when you first visit the site.

Third-party services

This site uses the following third-party services, each with their own privacy policies:

Your rights

Under the GDPR (General Data Protection Regulation), you have the right to:

  • Access the personal data I hold about you

  • Correct any inaccurate data

  • Delete your data (the "right to be forgotten")

  • Object to how your data is used

  • Withdraw consent at any time (e.g. unsubscribe from the newsletter)

  • Complain to a supervisory authority if you believe your rights have been violated

To exercise any of these rights, email me at tomas@tomasleach.com. I'll respond within 30 days.

The relevant supervisory authority in Spain is the Agencia Española de Protección de Datos (AEPD) — aepd.es.

Data retention

  • Newsletter subscribers: your email is kept until you unsubscribe

  • Shop customers: order records are kept for accounting and tax purposes as required by Spanish law

  • Contact emails: kept as long as reasonably needed to maintain our correspondence

Changes to this policy

If I make significant changes to this policy, I'll note the date at the top. For major changes, I may also mention it in the newsletter.